Loading story…
Security researchers have highlighted ongoing exploitation and new vulnerabilities in the NTLM authentication protocol, which remains widely used in enterprise environments despite its well-known weaknesses. Recent research details multiple attack vectors, including hash leakage, coercion-based attacks, credential forwarding, and man-in-the-middle (MitM) techniques, as well as the continued use of NTLM in modern operating systems and legacy applications. Notable campaigns in 2025 have leveraged vulnerabilities such as CVE-2024-43451, CVE-2025-24054, and CVE-2025-33073 to deliver malware and conduct targeted attacks, particularly in Russia and Uzbekistan.
Proof-of-concept exploits for NTLM elevation of privilege vulnerabilities have been released, further increasing the risk to organizations that have not yet migrated away from NTLM or implemented robust mitigations. Security experts recommend disabling or limiting NTLM, enabling message signing, and monitoring authentication logs to reduce exposure. The persistence of NTLM in critical infrastructure underscores the urgent need for organizations to transition to more secure authentication protocols and to remain vigilant against evolving exploitation techniques targeting NTLM weaknesses.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
A later report again emphasized that legacy NTLM weaknesses such as CVE-2024-43451 continued to pose risk in 2025. The coverage reinforced the persistence of the issue rather than introducing a separate incident.
Kaspersky published analysis describing multiple NTLM vulnerabilities, including CVE-2024-43451, CVE-2025-24054, CVE-2025-24071, and CVE-2025-33073, as actively exploited in 2025. The report highlighted continued attacker reliance on NTLM even as Microsoft moves to phase out the protocol.
A proof-of-concept exploit was publicly released for a Windows NTLM elevation-of-privilege vulnerability, increasing the risk of wider abuse. The reporting aligns this with the broader 2025 wave of NTLM-related exploitation and research attention.
Microsoft released a patch for CVE-2025-33073, an NTLM elevation-of-privilege vulnerability. Subsequent reporting indicated exploit code was later released and the flaw became part of broader concern over ongoing NTLM exploitation.
The Head Mare threat actor leveraged NTLM vulnerabilities in campaigns targeting organizations in Russia and Uzbekistan, using techniques such as phishing with malicious .url or .library-ms files and delivering malware including PhantomCore. The activity showed NTLM abuse expanding across multiple regions in 2025.
Microsoft released patches for CVE-2025-24054 and CVE-2025-24071, two additional NTLM-related vulnerabilities that enabled credential theft or related abuse paths. Reporting later noted both flaws were exploited in the wild in 2025.
Threat actor BlindEagle used CVE-2024-43451 in targeted attacks against organizations in Latin America, delivering malware such as Remcos RAT and AveMaria/Warzone via malicious files. The campaigns demonstrated continued real-world abuse of NTLM weaknesses after disclosure.
Microsoft released a fix for CVE-2024-43451, an NTLM-related vulnerability that could leak credentials with minimal user interaction. Later reporting says the flaw was subsequently exploited in the wild.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityonline.info
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2024-38200**, a vulnerability in **Microsoft Office 2016**, **Office 2019**, **Office LTSC 2021**, and **Microsoft 365 Apps** that can let a remote, unauthenticated attacker exfiltrate **NTLM** hashes used for authentication. The issue requires user interaction, such as opening a specially crafted file or clicking a malicious URL, and was assigned a **CVSS 7.5** severity score. Researchers from **PrivSec Consulting** identified the flaw and planned to present additional details at **DEF CON**. Microsoft said mitigations were rolled out through **Feature Flighting** for supported Office and Microsoft 365 versions and urged customers to install the August security updates. The company also recommended hardening steps to reduce NTLM exposure, including using the **Protected Users** security group in Windows Server to limit legacy authentication protections, blocking outbound NTLM communication where possible, and restricting outbound **TCP 445/SMB** traffic to prevent credential leakage.
Jul 24, 2026
Microsoft disclosed and patched several spoofing vulnerabilities across Windows and Exchange Server, including **NTLM hash disclosure** issues tracked as `CVE-2025-24996`, `CVE-2025-59185`, and `CVE-2025-59244`, a **Windows NTLM spoofing** flaw `CVE-2025-21217`, a **Windows Themes spoofing** bug `CVE-2025-21308`, a **Windows Shell Link Processing spoofing** issue `CVE-2026-25185`, and an older **Microsoft Exchange Server spoofing** vulnerability `CVE-2021-24085`. The advisories indicate a broad set of weaknesses that could let attackers disguise content or trigger credential exposure through trusted Windows components and enterprise messaging infrastructure. The concentration of flaws around NTLM and user-facing file handling highlights continued risk from spoofing paths that can mislead users or disclose authentication material. For defenders, the updates underscore the need to prioritize Microsoft security patches for systems handling Windows authentication, shell link processing, themes, and Exchange workloads, especially where NTLM remains enabled and could be leveraged for credential theft or follow-on intrusion.
Jul 12, 2026
Microsoft confirmed that **CVE-2026-32202**, a patched Windows Shell spoofing flaw, has been actively exploited in the wild after initially publishing incorrect exploitability information. The vulnerability is a **zero-click authentication coercion issue** tied to an incomplete fix for **CVE-2026-21510** and can be triggered when Windows Explorer processes a malicious `.LNK` file. Researchers said the shortcut’s crafted `LinkTargetIDList` can force the system to resolve an attacker-controlled UNC path, causing an outbound SMB connection and NTLM authentication attempt before SmartScreen trust checks occur. Akamai and CERT-UA linked the activity to **APT28**, which used weaponized LNK files in campaigns against Ukraine and several EU countries beginning in December 2025, chaining **CVE-2026-21513** with **CVE-2026-21510** for code execution and then abusing the residual flaw to capture **Net-NTLMv2** hashes for relay attacks or offline cracking. Microsoft addressed **CVE-2026-32202** in its April 2026 Patch Tuesday release, and defenders were urged to patch quickly, monitor outbound SMB traffic, and reduce or harden NTLM usage to limit follow-on credential abuse.
Jun 29, 2026